Experimental demonstration of four-party quantum secret sharing 
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Secret sharing is a multiparty cryptographic task in which some secret information is splitted 
into several pieces which are distributed among the participants such that only an authorized set of 
participants can reconstruct the original secret. Similar to quantum key distribution, in quantum 
secret sharing, the secrecy of the shared information relies not on computational assumptions, but 
on laws of quantum physics. Here, we present an experimental demonstration of four-party quantum 
secret sharing via the resource of four-photon entanglement. 



Entanglement is a fundamental resource for many 
quantum communication schemes. Bipartite entangle- 
ment has been used for the experimental demonstration 
of two-party quantum communication schemes like quan- 
tum dense coding quantum teleportation or en- 
tanglement based quantum cryptography Q. Similar to 
such two-party quantum communication schemes, multi- 
partite entanglement allows the experimental implemen- 
tation of multiparty quantum communication schemes, 
like multiparty quantum teleportation jj| , quantum tele- 
cloning |5| , multiparty quantum key distribution or quan- 
tum secret sharing (QSS) 0. 

Secret sharing was introduced independently in 1979 
by Shamir and Blakely 7, 8J. In a secret sharing scheme 
between n participants a designated party, usually called 
the dealer, splits some secret information into n— 1 shares 
and distributes these shares to each participant in such 
a way that only a particular authorized set of partici- 
pants can reconstruct that secret information. The qual- 
ified subsets of participants who can recover the secret 
are called access sets, subsets which have no informa- 
tion about the secret are called non-access sets and sub- 
sets which have partial information are called semi-access 
sets 0- Secret sharing has many different applications, 
e.g. the management of cryptographic keys, the estab- 
lishment of access codes with restricted access and as a 
component of secure multiparty computation. 

In contrast to classical secret sharing, the information 
splitting of a secret and the information distribution in 
QSS is realized by local measurements on distributed 
quantum states. Therefore, QSS allows to distribute the 
shares securely in the presence of eavesdropping. More- 
over, QSS distinguishes further between QSS of classical 
information 6] and QSS of quantum information |lf]j |. 
Here, we consider QSS of classical information. Different 
protocols for three and four-party QSS using the resource 
of multipartite entanglement have been proposed f(l ll l|. 
But, until now, only three-photon entanglement has been 
used to proof the experimental feasibility and to give an 
experimental demonstration of three-party QSS 0, El • 

In this Letter, we present the first experimental demon- 
stration of four-party QSS via four-photon entanglement. 
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In this scheme, any one of the four participants can act as 
the dealer, while the remaining three participants form 
the access set. For the experimental implementation, 
we use the following four-photon polarization-entangled 
state 0E3: 
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where H and V denotes horizontal and vertical po- 
larization of photons in the four spatial modes a, b, c 
and d. This state shows perfect four-photon polariza- 
tion correlations as indicated by the four-photon po- 
larization correlation function defined as the expecta- 
tion value of the product of the four operators s x — 
\+,$) x {+,$\-\-, $) x (- $| , with eigenstates \±,$) x = 
l/y/2(\R) ± e I( ^ \L)) and eigenvalues ±1, where R and L 
denote right- and lefthanded circular polarization. The 
explicit expression of this correlation function for the 
four-photon state given by Eq. l|T)l. is: 
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Another property of this state, which is useful for the 
realization of multiparty secure quantum communication, 
is its ability to violate a four-party Bell inequality 16]: 
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where each index y = k,l,m,n denotes a pair of an- 
gles defining the local polarization measurement settings 
required for the evaluation. A strong violation of this 
Bell inequality (with S — 1.886) is obtained e.g. for 
4> b ' = 0,7r/2 and <f> a ' cdi = 7r/4, — 7r/4, or any other set- 
ting resulting by permutation of the indices. 

The four-party QSS protocol works as follows: Al- 
ice, Bob, Claire and David share each a photon from 
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the ) state. In the following, we assume that Al- 
ice is the dealer. Each party chooses randomly between 
two complementary measurement bases. This can be for 
example either the {H, V} and {P, M\ basis (<f> x = 0, 
7r/2) analog to the BB84 protocol [l7|. or a basis set 
like {{22.5°, 112.5°}, {-22.5°, 67.5°}} (<f> x = tt/4, -tt/4), 
which can also be used to violate the Bell inequality given 
by Eq. © , in analogy to the Ekert scheme [l^l • To trans- 
fer the measurement results into a key sequence, each 
participant identifies his result either with a bit value of 
or 1. The measurements will be repeated until they 
have established a raw key of desired length. For key 
sifting, each participant announces publicly whenever he 
has registered a photon and which measurement basis 
he has used, but not the results. For the announcement, 
Bob, Claire and David send their information about their 
measurement to Alice. After that, Alice can decide which 
quadruples will be used for secure communication: Ac- 
cording to Eq. J2J, she will keep those results where all 
participants used the same basis setting and will drop all 
others. 

The information splitting works as follows: Consider 
e.g the case where all four parties have measured in the 
{H,V} basis. Suppose Bob obtained the result \H)b 
(|V)t), then he can not predict with certainty the mea- 
surement result of Alice, because there are two different 
possible outcomes for her. Similarly, each other partic- 
ipant is not able to obtain the secret of Alice without 
cooperation. Let us now consider pairwise cooperation. 
If Bob and Claire obtained the result \HV)bc (\VH)b c ), 
both together are not able to get the secret. They need 
the help of David to determine the key bit of Alice. Only 
in cases where Bob and Claire have obtained the result 
\HH)bc (\VV)bc) they can infer the key bit without the 
help of David. The same is true for Bob and David, or 
Claire and David. This implies that always two of them 
have some partial information on Alice's key. However, 
Bob, Claire and David must cooperate to retrieve the 
complete key and to ensure perfect information-theoretic 
security, the partial information of any semi-access set 
can be removed by the application of a hash function 
(privacy amplification) |lfjl2Cj . 

After key sifting, all participants have to check for ex- 
ternal eavesdropping. Depending on their chosen basis 
settings they can proceed as follows: If they used a basis 
set similar to the BB84 protocol, they can use a fraction 
of their measurement results (which should be perfectly 
correlated) for the evaluation of the quantum bit error 
rate (QBER) defined as the ratio of wrong bits to all 
bits. If the QBER is low enough, they can use their re- 
sults to distill a secure key, otherwise they have to discard 
their bits |2l| . If they used a basis set which can be used 
to violate the Bell inequality given by Eq. J2J, they can 
use a fraction of their measurement results for the evalu- 
ation. If the violation is high enough, they can use their 
key bits, otherwise they have to drop them [22| . 



To finally obtain a common secure key, they have to 
perform key reconciliation and privacy amplification. For 
this, different strategies developed for qua ntum key dis- 
tribution (QKD) can be adapted [ijj, |23j. After that, 
Alice can use the final key for an unbreakable encryp- 
tion of her secret information via the Vernam cipher |24j 
and broadcasts the encrypted message to Bob, Claire and 
David. Cooperation of Bob, Claire and David allows the 
reconstruction of the key and therefore to obtain the se- 
cret information of Alice. 

The four-party QSS protocol was experimentally im- 
plemented as sketched in Fig. ^ We used a mode-locked 
Ti:Sapphire laser emitting pulses with a pulse length 
of about 120 fs at a repetition rate of 82 MHz. This 
radiation is frequency-doubled with a lithium-triborate 
crystal to A = 390 nm which is used to pump a 2 mm 
thick beta-barium-borate crystal to generate the four- 
photon polarization-entangled state given by Eq. Q via 
pulsed type-II parametric down-conversion. This state 
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FIG. 1: Scheme of the experimental implementation: The 
four-photon source distributes the four photons of the en- 
tangled state m t° the four modes a,b,c and d. Each 
party uses a random number generator (RNG) which sets a 
half-wave plate (HWP) angle and a polarizing beam splitter 
(PBS) followed by two avalanche photodiodes for the analysis 
and registration of the distributed photons. 

results directly from the four-photon emission of the 
pulsed down-conversion source and the usage of two beam 
splitters to distribute these photons into the four spatial 
modes a, b, c and d [l5ll25| . Alice, Bob, Claire and David 
obtain each a photon from the four-photon state and 
measure randomly in one of two complementary bases 
chosen by a random number generator orienting a half- 
wave plate in front of a polarizing beam splitter via step 
motors. For the encoding, the detection of a photon in 
the transmitted (reflected) output mode of the polarizing 
beam splitter is set to a bit value of (1). The four pho- 
tons were detected by eight silicon avalanche photodiodes 
with detection efficiencies of about 40%. For the registra- 
tion of all 16 relevant four-photon coincidences, we used 
an eight-channel multi-photon coincidence unit |26j . We 
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observed a four-photon state rate of about 0.4 per sec- 
ond. To build up a shared key, the acquisition time for 
each randomly chosen analysis setting was set to 1 s. If 
more than one four-photon coincidence event was regis- 
tered during that time, only the first one was chosen. 

An analysis of the four-photon source used for the ex- 
perimental implementation, where Alice, Bob, Claire and 
David have measured in the {H, V} basis is shown in 
Fig. [3 The data acquisition time was 24 hours. Due 
to differences in the efficiencies of the detectors, the 
presented four-photon coincidences have been corrected 
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FIG. 2: Analysis of the four-photon source, where Alice, Bob 
Claire and David have chosen the {H, V} basis for their po- 
larization analysis. Shown are all possible four-photon coinci- 
dence detection events under the condition that in each of the 
four output modes a photon was detected. The four-photon 
correlation is E = 0.945 ± 0.002. 



without changing the overall raw detection rate. The cor- 
responding four-photon correlation is E = 0.945 ± 0.002, 
which demonstrates the high quality and stability of this 
four-photon source. 

To demonstrate the perfect four-party correlations, 
necessary for four-party QSS, we analyzed the four- 
photon correlations under different polarization analyzer 
orientations. In Fig. [3] (a) the results of two measure- 
ments are shown, where Alice, Claire and David have 
analyzed their photons in the {H, V} ({P, M}) basis cor- 
responding to 4> a ,c,d — (7r/2), while Bob varied his anal- 
ysis direction fa from to 47r. The maximal absolute 
value of E((p a , fa, fa, fa{) can be expressed by a visibility 
V according to E — VE, where E denotes the theoretical 
value. Fitting the experimental data leads to a visibility 
of V H /v = 92.3±0.8% and V P/M = 88.2±I.2%. Figured 
(b) shows the experimental results obtained from two 
measurements, where Alice, Claire and David analyzed 
their photons in the {22.5°, 112.5°} ({-22.5°, 67.5°}) ba- 
sis corresponding to </> ajC;( 2 = ir/4 (— 7r/4), while Bob 
varied his analyzer setting fa. The resulting visibili- 
ties are V 2 2.5°/n2.5° = 90.2 ± 1.1% and VL 2 2.5°/67.5° = 
89.0 ± 0.7%, respectively. The overall data acquisition 
time for each four-photon correlation function was 8.5 
hours. The average visibility can be translated into the 
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FIG. 3: Four-photon polarization correlations: Alice, Claire 
and David have set their polarization analysis orientation 
(0a,0c,0d) in (a) either to (rounds) or n/2 (triangles) cor- 
responding to the {{H, V}, {P, M}} basis set, or in (b) either 
to +7r/4 (rounds) or — n/4 (triangles) corresponding to the 
{{22.5°, 112.5°}, {-22.5°, 67.5°}} basis set, while Bob varied 
his polarization analyzer setting (fa) from to Att. The solid 
and the dashed lines represent numerical fits, leading in (a) to 
a visibility oiV H/v = 92.3%±0.8% and V P/M = 88.2%±1.2%, 
and in (b) to a visibility of V 2 2 5° /112 5° — 90.2% ± 1.1% and 
F_ 22 . 5 =/67.5° = 89.0% ± 0.7%. ' 



QBER via QBER = (1 - V)/2 leading to a QBER of 
4.88 ± 0.50% and 5.22 ± 0.45% for each basis set H3- 

For a full experimental demonstration of four-party 
QSS, we performed a key exchange according to the four- 
party QSS protocol described above using two different 
complementary basis sets. Using a key sifting analog to 
the BB84 protocol, we have exchanged 2000 key bits in a 
complete transfer time of about 16 hours with a QBER of 
5.20%. A fraction of 100 bits of the sifted key is shown in 
Fig. 0] Neglecting the dead time required to set the po- 
larization analysis direction and considering in addition 
those events which have been registered in the same time 
interval, leads to a bit rate of 196 bits per hour being 
in well agreement with the theoretical expected rate. To 
check for eavesdropping, Alice chooses a random subset 
of 200 bits (10%) of the sifted key and asks Bob, Claire 
and David for their results at those positions. From this 
subset, she evaluates the QBER and obtains a value of 
4% [2£| . This value lies well below several known se- 
curity threshold values required for two-party QKD and 
should therefore be low enough to distill finally a perfect 
secure key j^JH]}. Thus, using the remaining 1800 bits 
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XA 


0100111110101111000001000011000000110011110001011000110000111110011111110001010111101001100000001110 


X B 


00111101011011010001000110101101110101111001010101100101001011110101011010010111111010111010010O1010 


xc 


1010000000010010111110111100001111101000011010100111101111000011101001010110101000010110011111100001 


XD 


1101001011010000111011100101111000001100001010101001001011010000100010001110100000010100010110110101 


XAS 


0100111110101111000001000011000000110011110101011000110000111100011110110001010111101001100000011110 



FIG. 4: Sifted key: Shown are 100 out of 2000 experimentally exchanged four-party key bits. Bits printed in bold indicate 
errors. The first row shows the key of Alice denoted by xa- The second, third and fourth row shows each 100 key bits of Bob, 
Claire and David denoted by is, xc and xo- As can be seen, no one of them alone and no two parties of them together are 
able to obtain the key of Alice. Only by cooperation of Bob, Claire and David (access set) they will be able to reconstruct the 
key of Alice via the computation of the logical XOR function (xas — Xb ffl xc ffi xd = xa), as shown in the last row. 



to perform key reconciliation and privacy amplification, 
Alice ends up with a totally secure key with about 200 
bits |29j. For the reconstruction of the final key, Bob, 
Claire and David have to combine their individual bits of 
the reconciled key and have to perform the same privacy 
amplification procedure as Alice. 

Using the Bell angles (<fix 2 = 7r/4, — 7r/4) for key 
sifting, while Bob switches every fifth measurement to 
<pl' 2 = 0,7r/2, we obtained 1342 key bits in about 21 
hours with a QBER of 5.96%. Since 1/5 of the mea- 
sured data can be used to evaluate the Bell inequality 
given by Eq. J3J, we obtained a value of S — 1.78 ± 0.07, 
which is well above the classical limit of 1 and very close 
to the theoretical value of 1.886. Since the value for S 
scales linear with the visibility, the achieved value of S 
can be translated into a QBER of about 3%, which should 
be low enough to ensure secure quantum communication 

mm 

We demonstrated four-party QSS via the resource of 
four-photon entanglement. We obtained bit rates of 
about 100 bits per hour with QBERs of about 5%, which 
should be low enough to ensure perfect security. Compar- 
ing this with QBERs usually obtained in QKD between 
two parties, we obtain similar results demonstrating the 
feasibility of secure multiparty quantum communication 
via multi-photon entanglement. For future implementa- 
tions, it would be useful to use fast optical switches for 
an efficient registration. Using in addition known tech- 
niques to increase the efficiency of the key exchange, this 
scheme can be extended to obtain the maximal reachable 
efficiency jsOj . 
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